Overview
overview
10Static
static
037ff659cb...8f.exe
windows7_x64
10037ff659cb...8f.exe
windows10_x64
82fc92db641...fc.exe
windows7_x64
102fc92db641...fc.exe
windows10_x64
858c6424d1d...ed.exe
windows7_x64
1058c6424d1d...ed.exe
windows10_x64
8bc089259a1...5d.exe
windows7_x64
10bc089259a1...5d.exe
windows10_x64
10d3e7b5be90...57.exe
windows7_x64
10d3e7b5be90...57.exe
windows10_x64
8e72ace3a76...eb.exe
windows7_x64
10e72ace3a76...eb.exe
windows10_x64
10Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
16-07-2021 17:35
Static task
static1
Behavioral task
behavioral1
Sample
037ff659cb188100251c228a1babe2cd3bc3aaa43e0039555e12c232a8b9f38f.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral2
Sample
037ff659cb188100251c228a1babe2cd3bc3aaa43e0039555e12c232a8b9f38f.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral3
Sample
2fc92db641004976273712cdacab3f1416b6f7fcb8a6019bbb6ca539e9effefc.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral4
Sample
2fc92db641004976273712cdacab3f1416b6f7fcb8a6019bbb6ca539e9effefc.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral5
Sample
58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral6
Sample
58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral7
Sample
bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral8
Sample
bc089259a1da012b1331933427fdf29e62e0c66cc4ca69c2319dd45f13a95c5d.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral9
Sample
d3e7b5be903eb9a596b9b2b78e5dd28390c6aadb8bdd4ea1ba3d896d99fa0057.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral10
Sample
d3e7b5be903eb9a596b9b2b78e5dd28390c6aadb8bdd4ea1ba3d896d99fa0057.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral11
Sample
e72ace3a76024645161ecb73c57083d38b85594df5117de94d782df9f48a10eb.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral12
Sample
e72ace3a76024645161ecb73c57083d38b85594df5117de94d782df9f48a10eb.exe
Resource
win10v20210410
windows10_x64
General
-
Target
58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe
Malware Config
Signatures
-
Bandook Payload 2 IoCs
resource yara_rule behavioral5/memory/1532-66-0x0000000013C8F890-mapping.dmp family_bandook behavioral5/memory/800-69-0x0000000013C8F890-mapping.dmp family_bandook -
resource yara_rule behavioral5/memory/1416-62-0x0000000013140000-0x0000000013CEB000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\ztjiaabjdctflmwyzzbj = "C:\\Users\\Admin\\AppData\\Roaming\\ztjiaabjdctflmwyzzbj\\ztjiaabjdctflmwyzzbj.exe" iexplore.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1268 set thread context of 1416 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 29 PID 1268 set thread context of 1532 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 30 PID 1268 set thread context of 800 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 31 PID 1268 set thread context of 636 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1416 iexplore.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1268 wrote to memory of 1416 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 29 PID 1268 wrote to memory of 1416 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 29 PID 1268 wrote to memory of 1416 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 29 PID 1268 wrote to memory of 1416 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 29 PID 1268 wrote to memory of 1416 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 29 PID 1268 wrote to memory of 1416 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 29 PID 1268 wrote to memory of 1532 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 30 PID 1268 wrote to memory of 1532 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 30 PID 1268 wrote to memory of 1532 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 30 PID 1268 wrote to memory of 1532 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 30 PID 1268 wrote to memory of 1532 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 30 PID 1268 wrote to memory of 1532 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 30 PID 1268 wrote to memory of 800 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 31 PID 1268 wrote to memory of 800 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 31 PID 1268 wrote to memory of 800 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 31 PID 1268 wrote to memory of 800 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 31 PID 1268 wrote to memory of 800 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 31 PID 1268 wrote to memory of 800 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 31 PID 1268 wrote to memory of 636 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 32 PID 1268 wrote to memory of 636 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 32 PID 1268 wrote to memory of 636 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 32 PID 1268 wrote to memory of 636 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 32 PID 1268 wrote to memory of 636 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 32 PID 1268 wrote to memory of 636 1268 58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe"C:\Users\Admin\AppData\Local\Temp\58c6424d1d5365f3b596c311f77bf1635a84ecab176a829418ca2076974e91ed.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1416
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Adds Run key to start application
PID:1532
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:800
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:636
-